The approaches described in this section are approaches that could be pursued, but not necessarily approaches that have been previously conceived or pursued. Therefore, unless otherwise indicated, the approaches described in this section may not be prior art to the claims in this application and are not admitted to be prior art by inclusion in this section.
The proliferation of communications networks, and in particular the Internet, has raised growing concerns about the security of information transmitted over networks. Numerous protection schemes have been implemented to secure electronic documents transmitted over the Internet, ranging from simple passwords to strong encryption. Policy-based solutions have also been developed that allow business organizations to control access to electronic documents. An electronic document for which the access thereto is controlled using a policy is referred to hereinafter as “policy-enabled document.” A policy defines the conditions under which a user is granted access to an electronic document. For example, a policy might specify that particular users are allowed access to the electronic document. Alternatively, the policy might specify that all users on a particular project, or all users at a specified level or higher within a business organization, may access the electronic document.
When a user attempts to open the electronic document through an application, the application prompts the user for user credentials, typically in the form of a user ID and password. The user credentials are authenticated to verify the user. Then, the credentials are provided to a policy server along with data that identifies the electronic document that the user is attempting to access. The policy server retrieves a policy associated with the electronic document and then determines, based upon the policy, whether the user should be allowed to access the electronic document. The policy server returns data to the application that indicates whether the user is allowed to access the electronic document. The application selectively allows the user access to the electronic document based upon the data provided by the policy server.
One of the main benefits of the policy-based approach is that the access rights for any number of electronic documents may be changed by changing single policy, without having to change each of the electronic documents. For example, a business organization may change a single policy for a product that may affect access to a hundreds or even thousands of electronic documents.
One of the limitations of using policies to control access to electronic documents is that once a user has been granted access to an electronic document, the electronic document may be distributed to and accessed by other users, either in electronic or printed form. For example, once a user has been granted access to a policy-enabled electronic document and printed the document, third parties may access the printed document, with or without the consent of the user. Thus, policy-based solutions do not provide control over electronic documents once they have been printed, which can be a significant problem for documents containing sensitive information. Based on the foregoing, there is a need for an approach for controlling access to electronic documents that does not suffer from limitations of prior approaches.